External risk intelligence

Digits Unauthenticated Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-28165

The vulnerability affects a WordPress plugin, which typically operates as a web-facing application component. Because WordPress sites are frequently deployed as public-facing web services, this functionality is commonly exposed to the internet.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Digits software, allowing unauthenticated access to escalate privileges. This issue, affecting network-accessible systems, could potentially lead to unauthorized control over affected systems if the technology is in use within the organization. The primary concern is to determine if Digits is deployed and to assess the potential exposure.

Unauthenticated users can gain higher access.
Critical flaw impacts web-facing systems.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request over the network to a vulnerable system. This could allow them to gain higher privileges than they should have, potentially leading to full system control.

No authentication required.
Unauthenticated network request.
Privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to gain elevated privileges within the Digits system when it is exposed to the network. This could lead to unauthorized access and control over system functions and data.

System data and functionality.
Via network access.
Unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This vulnerability in the Digits plugin requires a coordinated effort between application owners and infrastructure or platform teams. The first practical step is to identify all instances of the Digits plugin across the environment, determine their network exposure, and assess their business criticality. Once identified, the accountable owner must be confirmed to prioritize and plan remediation, potentially involving vendor coordination or temporary risk reduction measures.

Application owners should oversee remediation.
Verify plugin instances and exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Digits software?

Digits is a plugin for WordPress designed to manage user authentication and registration. It simplifies how visitors sign up or log in to a WordPress-powered site, often by replacing standard login forms with customized interfaces. Because it integrates directly into the site's authentication flow, it handles sensitive traffic related to user accounts and session access.

What does CVE-2026-28165 mean for my security?

This vulnerability is classified as Incorrect Privilege Assignment (CWE-266). In plain terms, the software fails to properly verify who a user is before granting them elevated access rights. Because of this flaw, an attacker does not need to log in or possess any existing credentials to potentially gain the same permissions as an administrator or other high-level user.

How is this vulnerability triggered?

An attacker triggers this issue by sending a specially crafted request over the network to the affected WordPress installation. Crucially, because the software does not require authentication to process this request, no prior access or user account is needed to initiate the attack. Normal, non-malicious user traffic that follows standard registration procedures does not trigger this security failure.

Is my site likely to be targeted?

According to Halo Surface Signal, this vulnerability is highly relevant because it affects a WordPress plugin typically deployed as a web-facing service. Since most WordPress sites are intended to be accessible over the internet to function, the component is often exposed, providing attackers with a direct path to attempt this privilege escalation from anywhere online.

What steps should I take if I use Digits?

Start by identifying every instance of the Digits plugin running across your organization. Once you have a complete inventory, verify which instances are accessible over the network. Coordinate with your application owners to prioritize these systems for remediation, as they represent the most immediate risk for unauthorized control.

References

patchstack.com/database/wordpress/plugin/digits/vulnerability/wordpr…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.